Part X

MISCELLANEOUS

128Register

(1) The Commissioner shall maintain in both physical and electronic forms a register as required under this Act.

(2) A person may on payment of the prescribed fee-

(a)inspect the register; or

(b)make a copy of or take extracts from an entry in the register.

(3) Where a person requests that a copy of an entry in the register be provided in an electronic form, the Commissioner may provide the relevant information by way of electronic means.

129Transfer of personal data to places outside Malaysia

(1) A data user shall not transfer any personal data of a data subject to a place outside Malaysia unless to such place as specified by the Minister, upon the recommendation of the Commissioner, by notification published in the Gazette.

(2) For the purposes of subsection (1), the Minister may specify any place outside Malaysia if-

(a)there is in that place in force any law which is substantially similar to this Act, or that serves the same purposes as this Act; or

(b)that place ensures an adequate level of protection in relation to the processing of personal data which is at least equivalent to the level of protection afforded by this Act.

(3) Notwithstanding subsection (1), a data user may transfer any personal data to a place outside Malaysia if-

(a)the data subject has given his consent to the transfer;

(b)the transfer is necessary for the performance of a contract between the data subject and the data user;

(c)the transfer is necessary for the conclusion or performance of a contract between the data user and a third party which-

(i)is entered into at the request of the data subject; or

(ii)is in the interests of the data subject;

(d)the transfer is for the purpose of any legal proceedings or for the purpose of obtaining legal advice or for establishing, exercising or defending legal rights;

(e)the data user has reasonable grounds for believing that in all circumstances of the case-

(i)the transfer is for the avoidance or mitigation of adverse action against the data subject;

(ii)it is not practicable to obtain the consent in writing of the data subject to that transfer; and

(iii)if it was practicable to obtain such consent, the data subject would have given his consent;

(f)the data user has taken all reasonable precautions and exercised all due diligence to ensure that the personal data will not in that place be processed in any manner which, if that place is Malaysia, would be a contravention of this Act;

(g)the transfer is necessary in order to protect the vital interests of the data subject; or

(h)the transfer is necessary as being in the public interest in circumstances as determined by the Minister.

(4) Where the Commissioner has reasonable grounds for believing that in a place as specified under subsection (1) there is no longer in force any law which is substantially similar to this Act, or that serves the same purposes as this Act-

(a)the Commissioner shall make such recommendations to the Minister who shall, either by cancelling or amending the notification made under subsection (1), cause that place to cease to be a place to which personal data may be transferred under this section; and

(b)the data user shall cease to transfer any personal data of a data subject to such place with effect from the time as specified by the Minister in the notification.

(5) A data user who contravenes subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding three hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.

(6) For the purposes of this section, "adverse action", in relation to a data subject, means any action that may adversely affect the data subject's rights, benefits, privileges, obligations or interests.

130Unlawful collecting, etc., of personal data

(1) A person shall not knowingly or recklessly, without the consent of the data user-

(a)collect or disclose personal data that is held by the data user; or

(b)procure the disclosure to another person of personal data that is held by the data user.

(2) Subsection (1) shall not apply to a person who shows-

(a)that the collecting or disclosing of personal data or procuring the disclosure of personal data-

(i)was necessary for the purpose of preventing or detecting a crime or for the purpose of investigations; or

(ii)was required or authorized by or under any law or by the order of a court;

(b)that he acted in the reasonable belief that he had in law the right to collect or disclose the personal data or to procure the disclosure of the personal data to the other person;

(c)that he acted in the reasonable belief that he would have had the consent of the data user if the data user had known of the collecting or disclosing of personal data or procuring the disclosure of personal data and the circumstances of it; or

(d)that the collecting or disclosing of personal data or procuring the disclosure of personal data was justified as being in the public interest in circumstances as determined by the Minister.

(3) A person who collects or discloses personal data or procures the disclosure of personal data in contravention of subsection (1) commits an offence.

(4) A person who sells personal data commits an offence if he has collected the personal data in contravention of subsection (1).

(5) A person who offers to sell personal data commits an offence if-

(a)he has collected the personal data in contravention of subsection (1); or

(6) For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale is an offer to sell the personal data.

(7) A person who commits an offence under this section shall, upon conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding three years or to both.

131Abetment and attempt punishable as offences

(1) A person who abets the commission of or who attempts to commit any offence under this Act shall be guilty of that offence and shall, on conviction, be liable to the punishment provided for that offence.

(2) A person who does any act preparatory to or in furtherance of the commission of any offence under this Act shall be guilty of that offence and shall, on conviction, be liable to the punishment provided for the offence:

Provided that any term of imprisonment imposed shall not exceed one-half of the maximum term provided for the offence.

132Compounding of offences

(1) The Commissioner may, with the consent in writing of the Public Prosecutor, compound any offence committed by any person under this Act and prescribed to be a compoundable offence by making a written offer to the person suspected to have committed the offence to compound the offence upon payment to the Commissioner of an amount of money not exceeding fifty per centum of the amount of maximum fine for that offence within such time as may be specified in his written offer.

(2) An offer under subsection (1) may be made at any time after the offence has been committed but before any prosecution for it has been instituted, and if the amount specified in the offer is not paid within the time specified in the offer or such extended time as the Commissioner may grant, prosecution for the offence may be instituted at any time after that against the person to whom the offer was made.

(3) Where an offence has been compounded under subsection (1), no prosecution shall be instituted in respect of the offence against the person to whom the offer to compound was made, and any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized in connection with the offence may be released or forfeited by the Commissioner, subject to such terms and conditions as he thinks fit to impose in accordance with the conditions of the compound.

(4) All sums of money received by the Commissioner under this section shall be paid into the Federal Consolidated Fund.

133Offences by body corporate

(1) If a body corporate commits an offence under this Act, any person who at the time of the commission of the offence was a director, chief executive officer, chief operating officer, manager, secretary or other similar officer of the body corporate or was purporting to act in any such capacity or was in any manner or to any extent responsible for the management of any of the affairs of the body corporate or was assisting in such management-

(a)may be charged severally or jointly in the same proceedings with the body corporate; and

(b)if the body corporate is found to have committed the offence, shall be deemed to have committed that offence unless, having regard to the nature of his functions in that capacity and to all circumstances, he proves-

(i)that the offence was committed without his knowledge, consent or connivance; and

(ii)that he had taken all reasonable precautions and exercised due diligence to prevent the commission of the offence.

(2) If any person would be liable under this Act to any punishment or penalty for his act, omission, neglect or default, he shall be liable to the same punishment or penalty for every such act, omission, neglect or default of any employee or agent of his, or of the employee of the agent, if the act, omission, neglect or default was committed-

(a)by that person's employee in the course of his employment;

(b)by the agent when acting on behalf of that person; or

(c)by the employee of the agent in the course of his employment by the agent or otherwise on behalf of then agent acting on behalf of that person.

134Prosecution

No prosecution for an offence under this Act shall be instituted except by or with the written consent of the Public Prosecutor.

135Jurisdiction to try offences

Notwithstanding any other written law to the contrary, a Sessions Court shall have jurisdiction to try any offence under this Act and to impose full punishment for any such offence under this Act.

136Service of notices or other documents

(1) Service of a notice or any other document upon any person shall be effected-

(a)by the delivering the notice or other document to the person;

(b)by leaving the notice or other document at the last-known address of residence or place of business of the person in a cover addressed to that person; or

(c)by forwarding the notice or other document by post in an A.R. registered letter addressed to the person at his last-known address of residence or place of business.

(2) Where the person to whom there has been addressed an A.R. registered letter containing any notice or other document which may be given under this Act is informed of the fact that there is an A.R. registered letter awaiting him at a post office, and such person refuses or neglects to take delivery of such A.R. registered letter, such notice or other document shall be deemed to have been served upon him on the date on which he was so informed.

137Public Authorities Protection Act 1948

The Public Authorities Protection Act 1948 [Act 198] shall apply to any action, suit, prosecution or proceedings against the Commissioner, Deputy Commissioner, Assistant Commissioner, any officer or servant of the Commissioner, any member of the Advisory Committee, any member, officer or servant of the Appeal Tribunal, or any authorized officer in respect of any act, neglect or default done or omitted by him or it in such capacity.